Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to know if any certificates support a double wildcard like *.*.example.com? I've just been on the phone with my current SSL provider (register.com) and the girl there said they don't offer anything like that and that she didn't think it was possible anyway.

Can anyone tell me if this is possible, and if browsers support this?

share|improve this question
add comment

6 Answers 6

This could be worth a new round of tests with current browser versions.

My personal quick check results in: Firefox 20.0.1 seems to still not support this. It shows:

This certificate is only valid for *.*.mydomain.com

...when surfing to https://svn.project.mydomain.com.

Internet Explorer 9.0:

The certificate of this website was made for another address

Notes:

  • Both statements translated from German to English, by me. Probably I did not use the same phrases as the English browser versions would show.
  • I used a self-signed certificate. Which caused the browsers to show an additional sentence of warning. I assume that the quotes above would also be shown with a trusted certificate issuer. Verifying this was out of the scope of my "quick check".
share|improve this answer
add comment

What you can do is something like *.domain.com and then *.www.domain.com or *.mail.domain.com. I've never seen *.*.domain.com on a production site.

You can get a wildcard (*.domain.com) but you will also need *.www.domain.com as a alternative subject name entry to get this to work. The only companies that I know offer this are ssl.com and digicert. There may be others but I'm not sure.

share|improve this answer
add comment

I was just doing some research on this as I have the same requirements to secure sub subdomains as well and came across a solution from DigiCert.

This certificates says it will support yourdomain.com, *.yourdomain.com, *.*.yourdomain.com and so on.

It is currently rather pricy, but the hope is that other providers would start offering similar certificates and reduce prices.

share|improve this answer
add comment

Just to confirm FF and IE 8 will NOT accept certificates in the form *.*.example.com although it is technically possible to create them.

share|improve this answer
add comment

RFC2818 states:

If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

Internet Explorer behaves in the way outlined by the RFC, where each level needs its own wildcarded certificate. Firefox is happy with a single *.domain.com where * matches anything in front of domain.com, including other.levels.domain.com, but will also handle the *.*.domain.com types as well.

So, to answer your question: it is possible, and supported by browsers.

share|improve this answer
1  
Thank you! Testing on FF 3.5.7 this morning showed that it is now RFC compliant in the same way as IE. It rejected my .example.com cert for foo.bar.example.com. So just to clarify all I need is another wildcard cert that has *..example.com as the Common Name? –  Rob Long Jan 19 '10 at 17:04
    
correct, based on that you would need a *.*.example.com –  Alex Jan 19 '10 at 18:41
3  
I just tested in FF 3.5 and IE 8 and neither would accept a certificate for ..example.com. I think the only solution is to use multiple wildcard certificates. –  Robert Jan 21 '10 at 1:16
1  
Who wrote this standard? This is worthless. Also a waste of money if you ask me. What does it protect? –  Brent Pabst Apr 2 '12 at 23:15
1  
If double-wildcards cause problems, do specific subdomains around wildcards work? ala SubjectAltName: DNS:foo.*.example.com, DNS:bar.*.example.com –  rcoup May 1 '12 at 21:19
add comment

there is no need for double wildcard as the single wildcard can accommodate any subdomains under the domain.com domain.

http://www.mail-archive.com/plug@lists.linux.org.ph/msg17605.html

share|improve this answer
5  
I have done some testing on this in the past with self-signed certs. Firefox behaved as you suggest, where one *.domain.com covered it all. Internet Explorer, on the other hand, treats the wildcard ONLY for that portion of the domain. So you would need to have 2 wildcarded certs to secure both www.domain.com (*.domain.com) and secure.mail.domain.com (*.*.domain.com) as the original question is stated. –  Alex Jan 19 '10 at 15:18
1  
@Alex is right, see his answer! –  Stefano May 10 '11 at 10:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.